Menu
Community /Pin to ProfileBookmark
@NogDogFeb 23.2006 — #One way a malicious user can do this is to copy the page source from their browser, then change the select field to an input field and submit from their altered page. (Or, if they're a hard-core hacker, just manually create the raw post data and send it via HTTP.) Therefore, you should always validate any inputs which can have an adverse effect if not within a given set of values. (I suppose it's also possible they're using some non-standard browser that creats a combo box instead of a list box for select elements, but I'm not aware that any mainstream browsers do this.) @NogDogFeb 23.2006 — #
Interesting. Guess that just reinforces the point that you should never trust the incoming data from the client.
ability to input text not in a dropdown menu
Is it possible for someone to input their own text into an input field that is a dropdown menu? I have a dropdown menu that is PHP driven and somehow a customer was able to input a piece of text into the input that was not in the dropdown menu.
By doing this, it screwed up a bunch of PHP if statements on later pages, so I am trying to figure out how or if this is possible.
Sign in
to post a comment6 Comments(s) ↴
0
@NogDogFeb 23.2006 — #0
@NogDogFeb 23.2006 — #Firefox + WebDeveloper extension, it allows you to convert select elements into text fields plus edit the html of a page + many other thingys is really usefull for testing your sites, but might aswell be used by the Dark Side[/QUOTE]
Interesting. Guess that just reinforces the point that you should never trust the incoming data from the client.